Changes to DBMS security labels should be audited.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-15657	DG0172-SQLServer9	SV-21490r1_rule	ECLC-1	Medium

Description
Some DBMS systems provide the feature to assign security labels to data elements. The confidentiality and integrity of the data depends upon the security label assignment where this feature is in use. Changes to security label assignment may indicate suspicious activity.

STIG	Date
Microsoft SQL Server 2005 Database Security Technical Implementation Guide	2015-06-16

Details

Check Text ( C-23697r1_chk )
If no data is identified as being sensitive or classified by the Information Owner, in the System Security Plan or in the AIS Functional Architecture documentation, this check is Not a Finding. If no identified sensitive or classified data requires encryption by the Information Owner in the System Security Plan and/or AIS Functional Architecture documentation, this check is Not a Finding. If the DBMS does not provide the capability to display sensitivity marking of data, this check is Not a Finding. For SQL Server 2005: Review the DBMS configuration for marking and labeling of sensitive data. http://www.microsoft.com/technet/prodtechnol/sql/2005/multisec.mspx If security label assignment is not audited for changes, this is a Finding.

Check Text ( C-23697r1_chk )

If no data is identified as being sensitive or classified by the Information Owner, in the System Security Plan or in the AIS Functional Architecture documentation, this check is Not a Finding.

If no identified sensitive or classified data requires encryption by the Information Owner in the System Security Plan and/or AIS Functional Architecture documentation, this check is Not a Finding.

If the DBMS does not provide the capability to display sensitivity marking of data, this check is Not a Finding.

For SQL Server 2005:

Review the DBMS configuration for marking and labeling of sensitive data.
http://www.microsoft.com/technet/prodtechnol/sql/2005/multisec.mspx

If security label assignment is not audited for changes, this is a Finding.

Fix Text (F-20183r1_fix)
Define the policy for auditing changes to security labels defined for the data. Document the audit requirements in the System Security Plan and configure database auditing in accordance with the policy.